CVE-2026-123357

Name of the Vulnerable Software and Affected Versions GROBID versions prior to 0.9.1

Description The Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java improperly handles PDF filenames. When a filename is passed through DocumentSource.pdfalto, it is interpolated into a bash -c command string. An attacker can use a single quote in the filename to break the quoting mechanism, which is then executed by ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java via ProcessBuilder. This allows for the execution of arbitrary commands with the privileges of the GROBID process.

Recommendations Update to version 0.9.1.